ci: fix CodeQL build failures by using correct Python version

[tianjianjiang]

User description

Summary

Fixes CodeQL Swift and C++ analysis failures caused by Python version mismatch.

Problem

The CodeQL workflow was failing with these errors:

• ExternalBuildToolExecution Data (Python-related)
• SwiftEmitModule normal arm64 Emitting module for SQLite (cascading failure)
• Overall build failure with exit code 65

Root cause:

1. The workflow sets up Python 3.12 via actions/setup-python
2. But xcodebuild doesn't inherit this Python in its environment
3. The Makefile uses hardcoded python3 which resolves to Xcode's bundled Python 3.9
4. When PR feat: modernize Python project #719 modernizes Python code with 3.10+ syntax, builds fail with the older Python

Solution

This PR makes three key changes:

1. Add Python 3.12 setup to the CodeQL workflow
2. Pass PYTHON environment variable to xcodebuild: PYTHON=$(which python3) xcodebuild ...
3. Update Makefile to use $(PYTHON) variable instead of hardcoded python3

This ensures:

• CodeQL builds use Python 3.12 from GitHub Actions
• The Makefile respects the environment's Python version
• Backward compatibility is maintained (defaults to python3 if not set)
• PR feat: modernize Python project #719 will pass CodeQL checks once merged

Testing

• Fixes https://github.com/openvanilla/McBopomofo/actions/runs/18998321918
• CI will validate this fix when the PR is opened

🤖 Generated with Claude Code

---

PR Type

Enhancement, Bug fix

---

Description

• Ensure CodeQL uses Python 3.12

• Pass PYTHON env to xcodebuild

• Makefile uses configurable PYTHON variable

• Stabilize Swift/C++ CodeQL builds

---

Diagram Walkthrough

flowchart LR
  GA["GitHub Actions workflow"]
  PY["actions/setup-python@v6 (3.12)"]
  XB["xcodebuild with PYTHON env"]
  MK["Makefile uses $(PYTHON)"]
  QL["CodeQL init/analyze"]

  GA -- "sets up" --> PY
  PY -- "provides python3 path" --> XB
  XB -- "invokes" --> MK
  MK -- "runs Python modules" --> QL

Loading

File Walkthrough

	Relevant files
Configuration changes	codeql.yml CodeQL workflow uses Python 3.12 and passes env                    .github/workflows/codeql.yml Add Python 3.12 setup via actions/setup-python@v6. Export PYTHON to xcodebuild invocation. Keep manual build and CodeQL steps unchanged otherwise. +6/-1
Enhancement	Makefile Makefile parameterizes Python executable                                  Source/Data/Makefile Introduce PYTHON variable with default python3. Replace hardcoded python3 with $(PYTHON) in targets. Update script invocations to respect overridable Python. +7/-5

---

[gemini-code-assist]

Summary of Changes

Hello @tianjianjiang, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves recurring CodeQL build failures that were caused by a Python version mismatch in the CI environment. The core change involves modifying the Source/Data/Makefile to dynamically use a specified Python executable, thereby ensuring that Python scripts are run with the intended version (e.g., Python 3.12) and preventing errors from outdated Python interpreters.

Highlights

• Makefile Modernization: The Source/Data/Makefile has been updated to use a configurable PYTHON variable instead of hardcoding python3 for executing Python scripts. This allows the build environment to specify the Python interpreter.
• Python Version Compatibility: A new PYTHON variable is introduced at the top of the Makefile, defaulting to python3. This change ensures that Python scripts within the build process can utilize the correct Python version, addressing compatibility issues with newer Python syntax in CI workflows.

Ignored Files

• Ignored by pattern: .github/workflows/** (1)
  • .github/workflows/codeql.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Correct Makefile indentation Fix the recipe indentation to use a single tab; leading spaces can cause Make to misinterpret the line and fail. Ensure consistent tab indentation across all targets. Source/Data/Makefile [28] associated-phrases-v2.txt: data.txt curation/builders/phrase_deriver.py associated-punctuation.txt - $(PYTHON) -m curation.builders.phrase_deriver $< $@ associated-punctuation.txt + $(PYTHON) -m curation.builders.phrase_deriver $< $@ associated-punctuation.txt Suggestion importance[1-10]: 7 __ Why: The recipe currently shows two leading tabs; Make requires a single tab and extra spaces/tabs can be error-prone, so normalizing to one tab improves correctness and portability.	Medium
	Persist Python path to env Export the resolved Python path to the environment so subprocesses (e.g., build scripts) reliably see it. Using a simple shell variable may not propagate to nested tools invoked by xcodebuild. .github/workflows/codeql.yml [62-64] - name: Build project run: | - PYTHON=$(which python3) xcodebuild -scheme McBopomofoInstaller -configuration Debug build ARCHS=arm64 ONLY_ACTIVE_ARCH=YES + echo "PYTHON=$(which python3)" >> $GITHUB_ENV + xcodebuild -scheme McBopomofoInstaller -configuration Debug build ARCHS=arm64 ONLY_ACTIVE_ARCH=YES Suggestion importance[1-10]: 6 __ Why: Using $GITHUB_ENV to export PYTHON makes the path available to any nested processes launched by xcodebuild, improving reliability over a shell-local variable; change is reasonable though not strictly required by the diff.	Low
General	Use absolute Python interpreter Resolve python3 to an absolute path once to avoid mismatches when different shells or tools alter PATH. This ensures consistent Python usage during builds and within nested invocations. Source/Data/Makefile [1] -PYTHON ?= python3 +PYTHON ?= $(shell command -v python3) Suggestion importance[1-10]: 5 __ Why: Resolving python3 via command -v can reduce PATH-related inconsistencies and aligns with the PR intent to centralize Python selection, but it's a minor robustness improvement.	Low

[gemini-code-assist]

Code Review

This pull request addresses a CodeQL build failure by making the Python interpreter used in the Source/Data/Makefile configurable. The change introduces a PYTHON variable, defaulting to python3, and replaces all hardcoded python3 calls with $(PYTHON). This is a clean and effective solution that correctly uses Makefile conventions to allow overriding the Python version from the environment, which will resolve the CI issue described. The changes are well-implemented and I have no further suggestions.

[Copilot]

Pull Request Overview

This PR makes the Python interpreter configurable in the build process by introducing a PYTHON Makefile variable and ensuring it's propagated through the GitHub Actions CI pipeline.

• Adds a PYTHON variable to the Makefile with a default value of python3, allowing it to be overridden
• Updates all Python invocations in the Makefile to use $(PYTHON) instead of hardcoded python3
• Configures the CodeQL workflow to set up Python 3.12 explicitly and pass the Python path to xcodebuild

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Source/Data/Makefile	Introduces configurable PYTHON variable and replaces all hardcoded python3 commands with $(PYTHON) references
.github/workflows/codeql.yml	Adds Python 3.12 setup step and passes Python path as environment variable to xcodebuild

[Copilot]

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[claude]

Review Summary

This PR makes clean, focused changes to fix the CodeQL Python environment issue. The approach is solid:

Strengths:

• ✅ Consistently replaces hardcoded python3 calls with the $(PYTHON) variable throughout the Makefile
• ✅ Uses PYTHON ?= python3 to allow environment override while providing a sensible default
• ✅ Fixes a Makefile indentation issue (line 28) that could have caused problems
• ✅ The workflow change correctly passes the Python path to xcodebuild

Overall: The changes are well-executed and follow best practices. The PR successfully addresses the issue while improving the build system's flexibility. Nice work! 🎉

[claude]

Good fix! Setting the PYTHON environment variable ensures xcodebuild uses the correct Python interpreter. This addresses the CodeQL Python environment issue.

One suggestion: Consider documenting why this is needed in a comment, as it may not be immediately obvious to future maintainers that the build scripts rely on this variable.

[claude]

Excellent addition! Using PYTHON ?= python3 with the conditional assignment operator allows the Python executable to be overridden via environment variables or command-line arguments, while defaulting to python3. This follows Makefile best practices and makes the build system more flexible.

[claude]

Nice catch on the indentation! This line was previously indented with spaces instead of a tab, which is incorrect for Makefiles. The change to use $(PYTHON) is good, and fixing the indentation ensures the recipe will execute properly.